I still see no evidence that the procedures have been followed. However, run Hijackthis and fix the following entries. Ensure that you make backups as my Brazilian isn't that good:
F2 - REG:system.ini: UserInit=userinit.exe
O4 - HKLM\..\Run: [keyboard] C:\windows\keyboard5.exe
O4 - HKLM\..\Run: [mousepad] C:\windows\mousepad5.exe
O4 - HKLM\..\Run: [newname] C:\windows\newname5.exe
O4 - HKCU\..\Run: [SysBrand] C:\ARQUIV~1\iGv6\sysbrand.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.4rf.com
O20 - Winlogon Notify: Control Panel - C:\WINDOWS\system32\enlol1331.dll
O23 - Service: SAFMMSEventsService - Unknown owner - C:\Arquivos de programas\SAF Tehnika\SAF Management\service\SAFMMSEventsService.exe
Reboot to Safe Mode, archive the following files and/or folders using Winzip or similar and then delete them:
C:\windows\keyboard5.exe
C:\windows\mousepad5.exe
C:\windows\newname5.exe
C:\WINDOWS\system32\enlol1331.dll
C:\ARQUIV~1\iGv6\
Reboot normally and post another logfile.
Remember, you absolutely must keep backups!!!